## Test Scope Analysis

### Features to Test

| Feature | Priority | API Endpoints | UI Components | Test Focus |
|---------|----------|---------------|---------------|------------|
| Authentication | MUST | 4 | 3 | Security, flows |
| [Feature] | MUST | [X] | [Y] | [Focus area] |

### Out of Scope

| Item | Reason |
|------|--------|
| [Item] | [Reason - e.g., third-party service, future phase] |

### Risk-Based Prioritisation

| Risk Area | Likelihood | Impact | Test Priority |
|-----------|------------|--------|---------------|
| Authentication bypass | Medium | Critical | P0 |
| Data validation | High | High | P0 |
| [Risk] | [L/M/H] | [L/M/H/Critical] | [P0/P1/P2] |

## API Test Spec: POST /auth/register

**Endpoint**: `POST /api/v1/auth/register`
**Priority**: P0 (MUST feature, security-critical)

### Happy Path Tests

| ID | Scenario | Input | Expected | Status Code |
|----|----------|-------|----------|-------------|
| REG-001 | Valid registration | Valid email, password, name | User created, tokens returned | 201 |
| REG-002 | Minimum valid password | 8 char password meeting requirements | Success | 201 |

### Validation Tests

| ID | Scenario | Input | Expected Error | Status Code |
|----|----------|-------|----------------|-------------|
| REG-V01 | Missing email | No email field | Validation error: email required | 400 |
| REG-V02 | Invalid email format | "not-an-email" | Validation error: invalid email | 400 |
| REG-V03 | Password too short | 7 char password | Validation error: min 8 chars | 400 |
| REG-V04 | Password no uppercase | all lowercase | Validation error: needs uppercase | 400 |
| REG-V05 | Password no number | no digits | Validation error: needs number | 400 |
| REG-V06 | Name too long | 101 char name | Validation error: max 100 chars | 400 |

### Error Handling Tests

| ID | Scenario | Setup | Input | Expected | Status Code |
|----|----------|-------|-------|----------|-------------|
| REG-E01 | Duplicate email | User exists | Same email | Email already registered | 409 |
| REG-E02 | Database unavailable | DB down | Valid data | Internal error (generic) | 500 |

### Security Tests

| ID | Scenario | Attack Vector | Expected Behaviour |
|----|----------|---------------|-------------------|
| REG-S01 | SQL injection in email | `'; DROP TABLE users;--` | Rejected or escaped, no SQL error |
| REG-S02 | XSS in name | `<script>alert('xss')</script>` | Stored escaped or rejected |
| REG-S03 | Password in response | Valid registration | Password not in response body |
| REG-S04 | Rate limiting | 100 requests in 1 minute | 429 after threshold |

### Performance Requirements

| Metric | Target | Test Method |
|--------|--------|-------------|
| Response time (p95) | < 500ms | Load test with 10 concurrent |
| Throughput | 50 req/s | Sustained load test |

## Integration Test: User Registration Flow

**Flow**: Register → Verify Email → Login → Access Protected Resource

### Test Cases

| ID | Step | Action | Expected Result | Dependencies |
|----|------|--------|-----------------|--------------|
| FLOW-REG-01 | 1 | POST /auth/register | 201, tokens returned | — |
| FLOW-REG-02 | 2 | GET /users/me with token | 200, user data | Step 1 |
| FLOW-REG-03 | 3 | POST /auth/login | 200, new tokens | Step 1 |
| FLOW-REG-04 | 4 | Access protected endpoint | 200, authorized | Step 3 |

### Edge Cases

| ID | Scenario | Steps | Expected |
|----|----------|-------|----------|
| FLOW-REG-E01 | Token expiry | Wait 15min, then access | 401, then refresh works |
| FLOW-REG-E02 | Invalid refresh | Use expired refresh token | 401, user logged out |

## Security Test Specifications

### Authentication Security

| ID | Threat | Test Scenario | Pass Criteria |
|----|--------|---------------|---------------|
| SEC-AUTH-01 | Brute force | 10 failed logins | Account locked or rate limited |
| SEC-AUTH-02 | Token reuse | Use token after logout | Token rejected |
| SEC-AUTH-03 | Weak password | Register with "password" | Rejected |
| SEC-AUTH-04 | Enumeration | Invalid email login | Same error as wrong password |

### Data Protection

| ID | Threat | Test Scenario | Pass Criteria |
|----|--------|---------------|---------------|
| SEC-DATA-01 | SQL injection | Inject in all inputs | No SQL errors, data safe |
| SEC-DATA-02 | XSS stored | Inject script in fields | Output escaped |
| SEC-DATA-03 | IDOR | Access other user's data | 403 or 404 |
| SEC-DATA-04 | Mass assignment | Send extra fields | Extra fields ignored |

### Infrastructure

| ID | Threat | Test Scenario | Pass Criteria |
|----|--------|---------------|---------------|
| SEC-INFRA-01 | HTTPS only | Access via HTTP | Redirect to HTTPS |
| SEC-INFRA-02 | Security headers | Check response headers | CSP, HSTS, etc. present |
| SEC-INFRA-03 | CORS | Cross-origin request | Only allowed origins |

## Performance Test Specifications

### Load Test Scenarios

| ID | Scenario | Users | Duration | Target |
|----|----------|-------|----------|--------|
| PERF-LOAD-01 | Normal load | 50 | 10 min | p95 < 200ms |
| PERF-LOAD-02 | Peak load | 200 | 5 min | p95 < 500ms |
| PERF-LOAD-03 | Sustained | 100 | 1 hour | No degradation |

### Endpoint Benchmarks

| Endpoint | Target p95 | Max p99 | Baseline |
|----------|------------|---------|----------|
| POST /auth/login | 100ms | 200ms | TBD |
| GET /users/me | 50ms | 100ms | TBD |
| [Endpoint] | [Target] | [Max] | TBD |

### Stress Test Scenarios

| ID | Scenario | Condition | Expected |
|----|----------|-----------|----------|
| PERF-STRESS-01 | Database slow | +500ms latency | Graceful degradation |
| PERF-STRESS-02 | Memory pressure | 80% memory | No OOM, recovers |
| PERF-STRESS-03 | Connection exhaustion | Max connections | Queue or reject gracefully |

## UI Test Specifications

### Component Tests

| Component | States to Test | Accessibility | Responsive |
|-----------|----------------|---------------|------------|
| Button | default, hover, active, focus, disabled, loading | ✓ | ✓ |
| Input | default, focus, error, disabled | ✓ | ✓ |
| LoginForm | empty, filled, submitting, error | ✓ | ✓ |

### User Flow Tests (E2E)

| ID | Flow | Steps | Assertions |
|----|------|-------|------------|
| E2E-001 | Complete registration | Fill form → Submit → See dashboard | Dashboard visible, user menu shows name |
| E2E-002 | Login with valid creds | Fill login → Submit → Dashboard | Redirected, token stored |
| E2E-003 | Login with invalid creds | Fill wrong password → Submit | Error shown, stay on login |

### Accessibility Tests

| ID | Requirement | Test Method |
|----|-------------|-------------|
| A11Y-001 | Keyboard navigation | Tab through all interactive elements |
| A11Y-002 | Screen reader | Verify ARIA labels with VoiceOver/NVDA |
| A11Y-003 | Colour contrast | Run axe on all pages |
| A11Y-004 | Focus visible | Verify focus ring on all interactive |

---
document_type: test_spec
version: "1.0.0"
status: draft
created_by: qa_engineer
created_at: "[timestamp]"
project: "[project-slug]"

phase: 3c
depends_on:
  - document: "03-architecture/technical-architecture.md"
    version: ">=1.0.0"
    status: approved
---

# Test Strategy: [Project Name]

## Executive Summary

- **Total test cases**: [X]
- **P0 (Critical)**: [X] cases
- **P1 (High)**: [X] cases
- **P2 (Medium)**: [X] cases

## Test Types Coverage

| Type | Count | Automated | Manual |
|------|-------|-----------|--------|
| API/Unit | [X] | [X] | 0 |
| Integration | [X] | [X] | 0 |
| E2E | [X] | [X] | [X] |
| Security | [X] | [X] | [X] |
| Performance | [X] | [X] | 0 |
| Accessibility | [X] | [X] | [X] |

## Test Environment Requirements

| Environment | Purpose | Data |
|-------------|---------|------|
| Local | Developer testing | Seed data |
| CI | Automated tests | Fresh + seed |
| Staging | Integration/E2E | Production-like |

## Test Data Strategy

| Data Type | Source | Refresh |
|-----------|--------|---------|
| User accounts | Seed script | Per test run |
| [Entity] | Fixtures | As needed |

## Quality Gates

### CI Pipeline Gates

| Gate | Criteria | Blocking |
|------|----------|----------|
| Unit tests | 100% pass | Yes |
| Coverage | > 80% | Yes |
| Security scan | No critical/high | Yes |
| E2E smoke | Core flows pass | Yes |

### Pre-Release Gates

| Gate | Criteria | Blocking |
|------|----------|----------|
| Full E2E | 100% pass | Yes |
| Performance | Meets targets | Yes |
| Security audit | No open critical/high | Yes |
| Accessibility | WCAG AA | Yes |

## Detailed Test Specifications

See individual spec files:
- [./test-specs/api-auth.md](./test-specs/api-auth.md)
- [./test-specs/api-users.md](./test-specs/api-users.md)
- [./test-specs/security.md](./test-specs/security.md)
- [./test-specs/performance.md](./test-specs/performance.md)
- [./test-specs/e2e-flows.md](./test-specs/e2e-flows.md)

---

*Generated by QA Specs Agent v1.0.0*
*Auto-triggered after Architecture approval*

✅ Test Specifications complete for [Project Name]

**Created**:
- Test strategy with [X] total test cases
- API test specs for [X] endpoints
- Security test specs from threat model
- Performance test specs with targets
- E2E flow specs for key journeys

**For Backend/Frontend Engineers**:
- Test specs are ready — implement tests as you code
- Focus on P0 tests first
- Use test IDs for traceability

**For QA Validation (Phase 4)**:
- Specs are ready for test implementation
- Will validate when code is complete

**Parallel with**: Backend (3a), Frontend (3b)
**Next**: QA Validation (4) when implementation complete